Splunk Search

Improving Search Speed in Stats Query

TylerJVitale
Explorer

I'd like to run search to look at average and max values for every server over an extended period of time. Currently I'm doing

index=os sourcetype="sourcetype" source="source"|stats avg(Value) max(Value) by host

But this is taking an extremely long time to run. Is there a way to make this search more efficient?

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Are you running a separate search for each process? If so, you could build a simple if statement to specify the value like this

index=os
| eval CPU=if(counter="% Processor Time",'Value',"N/A")
| eval Disk=if(counter="% Free Space",'Value',"N/A")

If not then you may want to look into accelerated data models. This will run substantially faster than over the raw data

http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Acceleratedatamodels

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...